getting the complete URL request from block log

Question

Hello, 
 over the day we have a lot of block reports from different users in Sophos Central with this URL: 
 'https://trmcdn.eu' blocked due to category 'Intimate Apparel & Swimwear' 
 I assume, this site is hosting media files for newspapers or so in several subfolders. That's the only thing I could find with google. 
 Now I'd like to find out, what the complete URL was when we get such a log in Central. 
 How is that possible? 
 Thanks!

LHerzog · Accepted Answer

crawled through the log files and had expected this in here 
 C:\ProgramData\Sophos\Web Control 
 but it has no logs at all. 
 I found this here and it contains all the blocks: 
 C:\ProgramData\Sophos\Web Intelligence\Logs\2021-01-28.log 
 2021-01-28T10:51:18.442Z action=block why=policy policy-reason=category threat=- fileclass=- category=25 url=hxxps://trmcdn.eu 2021-01-28T10:51:22.577Z action=block why=policy policy-reason=category threat=- fileclass=- category=25 url=hxxp://trmcdn.eu/favicon/test/ 2021-01-28T10:51:22.678Z action=block why=policy policy-reason=category threat=- fileclass=- category=25 url=hxxp://trmcdn.eu/favicon.ico

getting the complete URL request from block log

Top Replies